Thread by @murchandamus

Let's talk about Taproot🥕!
I'll cover
• New features enabled by Taproot
• Things not included in Taproot

🧵1/X

2/ Taproot introduces a new output type called Pay to Taproot (P2TR). P2TR is similar to Pay to Public Key (P2PK), in that outputs lock funds directly to a public key rather than the hash of a key or script.

(See more here: learnmeabitcoin.com/technical/p2pk vs learnmeabitcoin.com/technical/p2pkh.)

3/ P2TR inputs are more blockspace efficient than the hash-based output types (P2PKH, P2SH, P2WPKH, and P2WSH), as P2TR saves the space needed to reveal the hash preimage and can be unlocked with only a signature in the input.

4/ P2TR (native segwit v1) but will be the first output type that uses the `bech32m` address encoding, an updated version of bech32 which was used for P2WPKH and P2WSH (native segwit v0).

podcast.chaincode.com/2021/04/16/bec…

5/ While the previous output types used the Elliptic Curve Digital Signing Algorithm (ECDSA), P2TR uses the Schnorr signatures.
Schnorr signatures use a more compact serialization format, making them smaller than ECDSA signatures.

b10c.me/blog/006-evolu…

6/ The Schnorr signing algorithm is linear, meaning that multiple signatures for the same message can be aggregated into a single signature. Also, public keys and their signatures can be tweaked with scalars. This allows a number of nifty tricks…

tlu.tarilabs.com/cryptography/d…

7/ _Key aggregation_
The linearity allows us to aggregate multiple public keys into one public key, e.g. via MuSig2. When funds received to such an address are spent, the use of multisig is indistinguishable from regular single-sig use.

medium.com/blockstream/mu…

8/ _Adaptor signatures (AS)_
AS or scriptless scripts encode script-like behavior directly into public keys by tweaking them with other data. AS can be used to create Discreet Log Contracts and coinswaps that look like regular transactions to uninvolved.
bitcoinops.org/en/topics/adap…

9/ _Taproot_
We'll put a single public key into a locking script but commit to both a public key and a Taptree. The UTXO can be spent _either_ via the `keypath` or via any leaf in the Taptree via the `scriptpath`.

The Taptree will transform multisig use:
murchandamus.medium.com/2-of-3-multisi…

10/ The leaves in the Taptree will use a new subset of Script, `Tapscript`. Tapscript removes a number of opcodes and replaces `OP_CHECKMULTISIG` with `OP_CHECKSIGADD`. Tapscript is compatible with Miniscript simplifying smart contract development.
bitcoin.sipa.be/miniscript/

11/ _PTLCs_
Point Time Locked Contracts use an Adaptor Signature construction to replace the HTLCs currently used by Lightning network. They use less blockspace and cannot be correlated on-chain when channels close while payments are on-flight.
suredbits.com/payment-points…

12/ Not included: Cross Input Signature Aggregation (CISA/XISA), a feature that allows multiple inputs on one transaction to share a single signature will not be shipped. Every input still needs its own signature!
bitcoin.stackexchange.com/q/106224/5406

13/ Not included: `SIGHASH_ANYPREVOUT`, a new mode of spending inputs that lets signatures commit to a specific locking script rather than a specific UTXO. Required to roll out ELTOO, a new channel update protocol to replace LN-penalty.
anyprevout.xyz

14/ Not included: Entroot, a generalization of Taproot and Graftroot where every output always requires a signature and satisfying a script. This construction is useful to arbitrarily combine various script structures and for delegating funds.
gist.github.com/sipa/ca1502f84…

15/ I've also seen multiple claims that "Taproot will solve Bitcoin's scalability issue".—Taproot will only slightly increase the transaction throughput, mostly by reducing the size of multisig transactions.

16/ Altogether, we get:
• Better privacy
• Cheaper multisig
• Single-sig and multisig will be mostly indistinguishable
• Lightning improvements: PTLCs and aggregate keys as channel anchors
• A boost for scripting with DLCs, Adaptor Signatures, and Taptrees

17/17:
If you have questions or corrections, let me know!

PS: Eat more taproots.

18/17 Addendum 1: Not included: covenants. Taproot does not include any mechanisms to restrict the destinations outputs can be spent to.

19/17: Correction on Tapscript:
Tapscript disables exactly two opcodes, `OP_CHECKMULTISIG` and `OP_CHECKMULTISIGVERIFY`, redefines disabled opcodes to `OP_SUCCESS`, and introduces `OP_CHECKSIGADD`.

H/T @ajtowns